Installation of WikiSh

Download the WikiSh.zip file from the WikiSh page. Unzip it and place the php files in your cookbook. (Note that you must have at least version 2008-09-13 or later.)

Place the following lines in your config.php (This is the simplest installation for AuthUserSignup and would be used instead of any other config.php options listed in the WikiSh and WikiShConfig pages. Of course you can also mix&match the various configurations as long as you know what you are doing.):

Note that the display of this page when browsing is unimportant -- it is the actual source that is important. This page gives the appropriate read/write authorizations to be able to access and write to key administrative pages.

(Someone suggested the need for WikiShCrypt. The recipe AuthUserSignup does not make use of WikiShCrypt and so it is not necessary to install WikiShCrypt. Thus the comment has been removed.) Peter Bowers June 12, 2009, at 08:18 AM

Installation of MiscMX

Download MiscMX.php from MiscMX page (version 2008-09-13 or later) and place it in your cookbook directory

Place the usual line in your config.php:

include_once("$FarmD/cookbook/MiscMX.php");

Installation of WikiMail

Download wikimail.php (version 2008-08-08 or later) from the WikiMail page and place it in your cookbook directory

Place the usual line in your config.php:

include_once("$FarmD/cookbook/wikimail.php");

Configure the $WikiMailSMTP array as indicated on WikiMail page. Below might be a typical setting (replace the username, password, and domain as appropriate):

Create a page Login.Confirm (YOU MUST HAVE THE EDIT PASSWORD SET TO @admin OR SIMILAR) with the following source:

%comment% AuthUserSignup VERSION 2010-04-14 %%
(:linebreaks:)
{(wikish source {$FullName}#finishsignup)}
(:if false:)
[[#finishsignup]]
wikish_form process
if test -z ${user} || test -z ${code} || test ${code} == 0
then
echo "Please use the link provided in the email to access this page."
exit
fi
set -s AuthUserExtra = "SiteAdmin.AuthUserExtra"
set -s PAGEVARS = '' # suppress fmtpagename due to funky chars in passwd
if test -n ${newpass}
then
read --clear
# ANY CHANGE TO THE FIELDS REQUIRES A CHANGE ON THE LINE BELOW
grep "^${user}:" ${AuthUserExtra} | while read --IFS:: username fname lname phone email pagecode pass
do
if test ${pagecode} == ${code}
then
set -s newpass = 'a${RANDOM}'
set -s newcrypt = '`crypt ${newpass}`'
# Change the password in AuthUser if the username is confirmed there
if grep -q "^${username}:" SiteAdmin.AuthUser
then
grep -v "^${username}:" >SiteAdmin.AuthUser
echo "${username}:${newcrypt}" >>SiteAdmin.AuthUser
fi
# Now change the password in AuthUserExtra (also zero the code)
grep -v '^${username}:' ${AuthUserExtra} >Temp.AuthUserExtra
# ANY CHANGE TO THE FIELDS REQUIRES A CHANGE ON THE LINE BELOW
echo "${username}:${fname}:${lname}:${phone}:${email}:0:${newcrypt}" >>Temp.AuthUserExtra
cp -q Temp.AuthUserExtra ${AuthUserExtra}
echo "Password changed for user ${username}. The new password is '''${newpass}'''. It is recommended to go directly to [[Login.Signup]] to change your password."
exit
fi
done
echo "%red%Error: Your email link is not synchronized with the state of the password file. Please reissue your change-password request.%%"
else
if grep -q "^${user}:" SiteAdmin.AuthUser
then
echo "User ${user} already exists. Cannot add this user."
exit
fi
read --clear
# ANY CHANGE TO THE FIELDS REQUIRES A CHANGE ON THE LINE BELOW
grep "^${user}:" ${AuthUserExtra} | while read --IFS:: username fname lname phone email pagecode pass
do
if test ${pagecode} == ${code}
then
echo "${username}:${pass}" >>SiteAdmin.AuthUser
# Now make the code from a random number to a 0 to indicate it's confirmed
grep -v '^${username}:' ${AuthUserExtra} >Temp.AuthUserExtra
# ANY CHANGE TO THE FIELDS REQUIRES A CHANGE ON THE LINE BELOW
echo "${username}:${fname}:${lname}:${phone}:${email}:0:${pass}" >>Temp.AuthUserExtra
cp -q Temp.AuthUserExtra ${AuthUserExtra}
echo "User ${username} confirmed. You may log in immediately by clicking on [[Confirmed?action=logout|this link]]. "
echo "(By clicking on this link you will automatically be logged OUT before allowing you to log in again.)"
exit
fi
done
echo "Please use the link provided in the email to access this page." # Actually a wrong code, but let's avoid encouraging them trying a million times
fi
[[#finishsignupend]]
(:ifend:)

Create a page Login.Confirmed (SET THE READ PASSWORD TO id:* FOR THIS PAGE) with the following source:

%comment% AuthUserSignup VERSION 2010-04-14 %%
Congratulations! Your new user has been confirmed and logged in.

Check to make sure that both Login.Signup and Login.Confirm have the edit password set such that only an administrator can edit

You can change the information you are collecting to include fewer or additional or different fields. First you will change the form found on Login.Signup and then you will change both lines which are preceded (one on each page) with the comment "# ANY CHANGE TO THE FIELDS REQUIRES A CHANGE ON THE LINE BELOW"

If you wish to add an additional field to the 6 already collected (username, first name, last name, email, telephone #, password) then you will need to carefully scan through both Login.Signup and Login.Confirm. You will need to find each occurrence of the text "ANY CHANGE TO THE FIELDS" and check carefully in that vicinity for any changes that need to be made. If you wish to remove an existing field then it is easier to simply remove it from the form in Login.Signup and then locate the "require FIELDNAME" for that field and comment that out. (Note that telephone number is not a required field so removing it from the form at the top of Login.Signup suffices to remove it completely.)

Notes

Now users will go to Login.Signup to fill in the form. If all fields validate correctly then their information will be stored in SiteAdmin.AuthUserExtra and they will be sent an email with a link which they must click on. When they click on that link it will take them to the Login.Confirm page with an appropriate code specified and then their subscription will be confirmed and their information will be added to SiteAdmin.AuthUser.

A user can also fill in a username and password on the right-hand-form and click on "load form" to load the left-hand form with existing data in order to make modifications. Both SiteAdmin.AuthUserExtra fields as well as the password itself in SiteAdmin.AuthUser can be changed using this method.

You should make sure that SiteAdmin.AuthUserExtra and SiteAdmin.AuthUser have appropriate permissions. Presumably you want protected read AND protected edit for the former and at least protected edit for the latter.

Note that this recipe deals comfortably with users defined in the SiteAdmin.AuthUser page. It has no knowledge of LDAP nor htpasswd nor other methods of storing user accounts.

Release Notes

If the recipe has multiple releases, then release notes can be placed here. Note that it's often easier for people to work with "release dates" instead of "version numbers".

2010-04-14 - added an explicit line break ([[<<]]) after the form to prevent footers overwriting the form in certain skins. If you are upgrading from 2009-04-19 there is just that single addition to Login.Signup - no other changes for this release.

2009-04-19 - Fixed a problem with a read --initialize, restructured install instructions, added version info on each page

2009-04-15 - Added an explicit setting of $DebugLevel during installation

2009-04-14 - Added a check for existence of AuthUserExtra with a more graceful handling

2008-11-18 - It's gone live on at least one site and is working.

2008-09-28 - Most bugs worked out. Added lots of new capabilities for user admin.

2008-09-17 - I think this can be called a release now.

2008-09-14 - Still not formally released, but closer.

2008-09-10 - Not yet released formally. Still in testing.

See Also

UserAdmin - this is already probably superior to AuthUserSignup and will certainly be the successor (besides being much easier to install)